A Lightweight Block Cipher Based on a Multiple Recursive Generator

Olteanu, Alina; Xiao, Yang; Hu, Fei; Sun, Bo

doi:10.1109/glocom.2008.ecp.357

Cited by 1 publication

(12 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although not clearly specified, the MRG designers suggest the use of modulus $2^{31} {-} 1$ for efficiency improvement in cipher description 9:1 because $m = 2^{31} {-} 1$ and $\alpha _{1} = \cdots = \alpha _{k} < 2^{32} $ are popular values for the modulo and parameter sizes, respectively, we make the following restrictions: m < 2 32 and $\alpha _{1} , \ldots ,\alpha _{k} < 2^{32} $ . The use of modulus $2^{31} {-} 1$ enables efficient modular operations in both software and hardware.…”

Section: Summary Of the Mrg Ciphermentioning

confidence: 99%

“…When the MRG cipher uses a modulus of 31 bits (i.e. $m = 2^{31} {-} 1$ ) as suggested in Reference 9, each subkey X i ($ = x_{30} \ldots x_{0} $ ) also has 31 bits. The MSB of the intermediate value C ($ = c_{31} \ldots c_{0} $ ) is possible to change from plaintext P ($ = p_{31} \ldots p_{0} $ ) only if there is a carry bit from its lower bit position: $c_{31} = p_{31} \oplus \;carry{-} bit_{30} $ .…”

Section: A Distinguishing Attackmentioning

confidence: 99%

“…A block cipher based on MRG was proposed at IEEE GLOBECOM 2008 9, which uses initial MRG seeds as cipher key and generates a sequence to be used for encrypting 32‐bit plaintext each time. The cipher designers suggest the use of $m = 2^{31} {-} 1$ as MRG modulus and select a particular case with order k = 47 for performance analysis 9. The MRG cipher is claimed to be very useful and secure enough for resource limited environment such as sensor nodes and RFID tags.…”

Section: Introductionmentioning

confidence: 99%

“…In this paper, we firstly propose a distinguishing attack to reliably distinguish an MRG cipher using modulus $2^{31} {-} 1$ from encrypting with random sequence 9. It requires 2 18 words of ciphertext and each corresponding plaintext word's MSB.…”

Section: Introductionmentioning

confidence: 99%

“…When the MRG is optimized for efficiency, the attack requires only 2 k words of sequential plaintext and its corresponding ciphertext, where k is the order of MRG used for this cipher (e.g. k = 47 in the cipher illustrated in Reference 9). With 48 k decryption operations, the encryption system's state can be restored, the key is recovered, and all subsequent ciphertext can be decrypted.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Attacks on a lightweight cipher based on a multiple recursive generator

Xiao

Rose

2011

Security Comm Networks

View full text Add to dashboard Cite

At IEEE GLOBECOM 2008, a lightweight cipher based on a Multiple Recursive Generator (MRG) was proposed for use in resource limited environment such as sensor nodes and RFID tags. This paper proposes two efficient attacks on this MRG cipher. A distinguishing attack is firstly introduced to identify the use of an MRG cipher that has a modulus suggested by its designers. It requires 2 18 words of ciphertext and the most significant bit of each corresponding plaintext word. Then an efficient known plaintext attack is proposed to construct the cipher's current state and generate subkeys used for all subsequent encryption. The known plaintext attack, when targeted at the MRG ciphers optimized for efficiency, only requires 2k words of known plaintext and trivial computation where k is the MRG order. Even the ciphers based on complicated and inefficient MRGs can be attacked with low complexity, e.g., in the magnitude of 2 12 words of known plaintext for all MRG ciphers with order 47, regardless of which MRG modulus is used. These two attacks indicate that the examined MRG cipher structure is seriously flawed.

show abstract